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DETAILED ACTION 

1 . Claims 1, 2, 4-7, 9-13, and 15-20 remain for examination. Tine correspondence 
filed 8/1/08 amended claims 1, 7, 13, & 20; and cancelled claims 3, 8 & 14. 

Continued Examination Under 37 CFR 1.114 

2. A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1 .17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 8/1/08 
has been entered. 

Response to Arguments 

3. Applicant's arguments filed 8/1/08 have been fully considered but they are not 
persuasive. Although the Examiner appreciates the Applicant's latest explanation of the 
instant invention in plain language. Examiner remains unconvinced that there exists any 
non-trivial distinction between the P-Synch prior art and the claimed Invention. In 
response to the amended Independent claims. Examiner would like to draw Applicant's 
attention to pages 166-172, "5.13.3 WINKEY agent scripts", which explains In detail 
what Examiner believes to be, based on the various claim limitations and Applicant's 
remarks over the course of the prosecution history, the crux of the instant invention: 
namely, the ability for a password changing tool to use scripts that simulate keystrokes 
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to change one or more passwords to one or more accounts of a user. Specifically, this 
passage describes as one non-limiting example the use of a script to change a user's 
Lotus Notes password, wherein the script (which is stored in the password changing 
facility) also includes executable code and parameters needed to change the password 
for the application ("executable code" being the keywords in the scripting language 
disclosed across pages 167-168, with the parameters being the passwords and user ids 
represented by %u, %o, and the like on page 169); and also stores readable 
instructions for changing the password for the application (the example script stores the 
messages "Enter Password" and "Set Password" - i.e. readable, albeit rudimentary, 
instructions for changing a password - which the script is required to recognize before 
continuing with the change password operations - see the "waitf or" statements on 
page 171). Examiner respectfully maintains that the instant invention is at best an 
obvious variation over the prior art, and is therefore unpatentable. 

Claim Objections 

4. Applicant is advised that should claims 7 and 13 be found allowable, claims 10 
and 16 will be objected to under 37 CFR 1 .75 as being a substantial duplicate thereof. 
When two claims in an application are duplicates or else are so close in content that 
they both cover the same thing, despite a slight difference in wording, it is proper after 
allowing one claim to object to the other as being a substantial duplicate of the allowed 
claim. See MPEP § 706.03(k). Claims 7 and 13 were amended to incorporate these 
limitations; thus claims 10 & 16 fail to further limit the claimed invention. 
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Claim Rejections - 35 USC § 103 

5. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

6. Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over the 

P-Synch Installation and Administration Guide (Software version 4.2, Document Version 
4.50, last changed 6/1/2000; hereinafter "P-Synch") in view of "Using Privacy Features" 
web page (hereinafter, "Mozilla"). 

Regarding claim 1 : 

P-Synch discloses a tool for managing passwords, comprising: storage for a 
plurality of current passwords for a plurality of respective applications (password history, 
pages 33 & 34), and for each of said applications: a description of the application (page 
27, "3.1 .2 Target system information"), a description of the password type for the 
application (Ibid); previous passwords for the application (page 7, "Password history"), 
a Uniform Resource Locator for the application (page 27, "3.1.2 Target system 
information"; cf. page 28, Table 3.1), executable code and parameters needed to 
change the password for the application (pages 167-169) and readable instructions for 
changing the password for the application (the "wait for" instructions on page 171); 
means for displaying a reminder to change one or more passwords (page 14, "Expiry 
detection and password aging"); and a script for simulating keystroke entries to 
automatically perform a password change in said respective applications for said 
current passwords of said reminder (Ibid, and pages 13-14 and 167-172) wherein the 
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tool displays a list of the passwords, a description of the computer applications, a 
description of the procedure for changing the password, and a graphical user interface 
(pages 13-15, "WWW GUI" and "Windows GUI"; pages 54-55, "HOST statement" and 
Table 4.1; pages 69-70, disclosing the means by which this information is displayed; 
pages 246-247, Tables 8.6 and 8.7; while further observing that as the scripts are by 
definition a description of the procedure for changing the password, the ability to display 
the scripts for at least the purpose of editing them reads on that limitation); and a user 
uses the graphical user interface to invoke the scripts needed to change the passwords 
(pages 13-15, "WWW GUI" and "Windows GUI"), and the script tests proposed new 
passwords to determine if said proposed new passwords meet a defined criteria, and 
the script changes a password only if the proposed new password meets the defined 
criteria (page 7, "Password strength rules"; page 1 1 , "Enforcing strong password 
rules..."); and the tool having multiple degrees of security so that different users have 
different types of access to the tool (Help-desk users vs. end-users: see page 1 1 , the 
third and fourth bullet points; see also users vs. administrators on page 169). 

It is observed that the password storage area for holding previous passwords 
cited above is not used to store current passwords (page 60), although this is not to say 
that current passwords cannot be stored somewhere within the P-Synch tool, as 
knowledge of a current password is still required for the P-Synch scripts to function 
correctly (e.g. page 127, "Verify" bullet point, and page 169, "%o" the user's old 
password). However, it is observed that at least one embodiment of P-Synch is a web 
application, wherein a WWW browser is a required component of the overall P-Synch 
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tool to change one's passwords on the web (e.g. page 13, "WWW GUI"). Mozilla 
discloses the existence of a web browser comprising a password manager tool with 
storage for a user's current passwords, as well as the ability to view them (Mozilla, 
pages 5-8, "Using the Password Manager". It would have been obvious to one of 
ordinary skill in the art at the time of the invention to use the Mozilla web browser with 
the Password Manager component as the web browser component of the P-Synch tool, 
as the substitution of the Mozilla web browser in lieu of the generic web browser 
disclosed by P-Synch would have yielded predictable results to one of ordinary skill in 
the art at the time of the invention. Additionally, one would be motivated to incorporate 
storage for current passwords because Mozilla discloses wherein doing so because it 
facilitates subsequent logins to one's preferred web sites (page 7, "Entering User 
Names and Passwords Automatically"). 

Regarding claims 7 and 13: 

P-Synch discloses a method and program storage device comprising: 
accumulating a set of passwords in a password management facility, each of said 
passwords being associated with a computer application having a password change 
procedure (pages 13-15, "2.2.1 User Password Changes"); storing in the password 
management facility, for each of said applications: a description of the application (page 
27, "3.1 .2 Target system information"), a description of the password type for the 
application (Ibid); previous passwords for the application (page 7, "Password history"), a 
Uniform Resource Locator for the application (page 27, "3.1 .2. Target system 
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information"; cf. page 28, Table 3.1 ), executable code and parameters needed to 
change the password for the application (pages 167-169) and readable instructions for 
changing the password for the application (the "wait for" instructions on page 171); 
means for displaying a reminder to change one or more passwords (page 14, "Expiry 
detection and password aging"); providing the password management facility with a set 
of scripts to operate the password change procedures of the associated applications 
(pages 13-15) by simulating keystroke entries (e.g. pages 167-172); and a user invoking 
the password management facility (Ibid: "With a WWW GUI, users change their 
passwords from their browser", etc.), said facility, when invoked, displaying a list of the 
passwords, a description of the computer applications, a description of a procedure for 
changing the password, and a graphical user interface (pages 13-15, "WWW GUI" and 
"Windows GUI"; pages 54-55, "HOST statement" and Table 4.1 ; pages 69-70, the 
means to display the information; pages 246-247, Tables 8.6 and 8.7; while further 
observing that as the scripts are by definition a description of the procedure for 
changing the password, the ability to display the scripts for at least the purpose of 
editing them reads on that limitation); and using said graphical user interface to invoke 
or activate the scripts needed to change the passwords (pages 13-15, Ibid), including 
the steps of the scripts testing proposed new passwords to determine if said proposed 
new passwords meet a defined criteria, and the scripts changing a password only if the 
proposed new password meets the defined criteria (page 7, "Password strength rules"; 
page 11, "Enforcing strong password rules...") and the password management facility 
having multiple degrees of security so that different users have different types of access 
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to the tool (Help-desk users vs. end-users: see page 11 , the third and fourth bullet 
points; see also users vs. administrators on page 169). 

It is observed that the password storage area for holding previous passwords 
cited above is not used to store current passwords (page 60), although this is not to say 
that current passwords cannot be stored somewhere within the P-Synch system, as 
knowledge of a current password is still required for the P-Synch scripts to function 
correctly (e.g. page 127, "Verify" bullet point; and page 169, "%o" the user's old 
password). However, it is observed that at least one embodiment of P-Synch is a web 
application, wherein a WWW browser Is a required component of the overall P-Synch 
tool to change one's passwords on the web (e.g. page 13, "WWW GUI"). Mozilla 
discloses the existence of a web browser comprising a password manager tool with 
storage for a user's current passwords, as well as the ability to view them (Mozilla, 
pages 5-8, "Using the Password Manager". It would have been obvious to one of 
ordinary skill in the art at the time of the invention to use the Mozilla web browser with 
the Password Manager component as the web browser component of the P-Synch 
system, as the substitution of the Mozilla web browser in lieu of the generic web 
browser disclosed by P-Synch would have yielded predictable results to one of ordinary 
skill in the art at the time of the invention. Additionally, one would be motivated to 
incorporate storage for current passwords because Mozilla discloses wherein doing so 
because it facilitates subsequent logins to one's preferred web sites (page 7, "Entering 
User Names and Passwords Automatically"). 
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Regarding claims 2, 11, and 17: 

P-Synch further discloses wherein the applications are selected from the group 
including workstation applications, legacy host applications, server applications, and 
networked applications (Table 3.1 on page 28). 

Regarding claims 4, 9, and 15: 

P-Synch further discloses wherein the graphical user interface includes a series 
of activatable display elements, each display element being shown adjacent to one of 
the passwords to invoke script for changing said one password (pages 13-15). 

Regarding claim 5: 

P-Synch further discloses wherein at least some of the applications include a 

password change form and require a series of actions to get to the password change 
form, and the script includes means to perform said series of actions to get to the 
password change form (e.g. the sample script on pages 192-193). 

Regarding claims 6, 12, and 18: 

P-Synch and Mozilla further discloses wherein the passwords are encrypted in 
said storage (P-Synch: pages 33 and 34, bullet point "hist\"; Mozilla: page 12). 



Regarding claims 10 and 16: 
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P-Synch further discloses wherein each of the scripts simulates a set of 
keystroke entries or an executable program to change the password for one of the 
applications (Telnet scripts and Native APIs, respectively, on pages 13-15; cf. the 
sample scripts on pages 167-172 and 192-193). 

Regarding claim 19: 

P-Synch further discloses wherein the defined criteria are based on data from a 
user table (the user's password history table, pages 33 and 34). 

Regarding claim 20: 

P-Synch further discloses displaying user prompts to obtain information from the 
user when a script or code is invoked to change one of the passwords (pages 13-15); 
encrypting all of the data stored in the facility (pages 33 & 34, bullet point "hist\"; cf. 
pages 346-347); the script, based on a user identification, queries an employee table to 
determine an employee class associated with the user identification (page 207); and 
said criteria include [i] a proposed new password differs from a current password by a 
given number of characters (page 59, see the rule designated "mincharschanged=N") 
[ii] criteria based on data from user tables, user profile tables, and user history tables 
(page 7, "Password history"; page 36, line item #6; page 224, "End-user interface"); [iii] 
the user belongs to a certain class of employees (pages 35-36, and 207); and [iv] the 
proposed password must contain a number of alphabet characters, a number of 
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numeric cliaracters, and a number of punctuation characters (tlie minletters = n, 
mindigits = N, and minpunctuation = requirements, respectively, page 59). 

Conclusion 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Thomas Gyorfi whose telephone number is (571 )272- 
3849. The examiner can normally be reached on 8:30am - 5:00pm Monday - Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on (571 ) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

TAG 
11/25/08 
/Kimyen Vu/ 

Supervisory Patent Examiner, Art Unit 2435 



